Splunk Search

How to transform a table and use column headers as field values?

HeinzWaescher
Motivator

Hi,

I would like to do a transformation like this:

alt text

Can you help how to achieve this?

Thanks in advance
Heinz

1 Solution

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

View solution in original post

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

HeinzWaescher
Motivator

Awesome, thanks a lot!

0 Karma

sundareshr
Legend

Can you share the query for the first table

0 Karma

HeinzWaescher
Motivator

Unfortunately the first table would be the result of a csv

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...